CM-70024: temporary smctl diagnostics for cert sync

The keypair is visible in the KSP but smctl reports its certificate as
not found. List keypairs and certificates in CI to see the association
and status. To be removed before merge.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: omer-roth

.github/workflows/build_executable.yml

@@ -247,6 +247,11 @@ jobs:
           msiexec /i smtools-windows-x64.msi /quiet /qn
           C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
 
+          :: TODO(CM-70024): temporary diagnostics, remove before merge
+          smctl healthcheck --all
+          smctl keypair ls
+          smctl certificate ls
+
           :: certsync without an alias only syncs the first keypair the account returns,
           :: so the alias is required to get the current signing cert into the store
           smctl windows certsync --keypair-alias=%SM_KEYPAIR_ALIAS%